Dashboards & Visualizations

Hide data in frontend and remain set filters after reopening Splunk

julckr
Observer

Dear Splunk Community,

I am currently creating a Splunk dashboard and would like to save user-defined filters in the dashboard, even after Splunk has been reopened. 

Background: I have a table on a layer which data comes from SAP to Splunk via Push Extractor. Not all of the data displayed in the table is relevant, so I want to hide certain rows using a dropdown field/checkbox, which are then no longer included in the visualizations on the other layers.

  1. how can I ensure that these hidden rows are no longer included in the visualizations for all users of the dashboard?
  2. how can I ensure that the filter settings remain visible even after the dashboard has been closed for >24 hours?

I really hope that someone can help me with this.

Kind regards

Julian

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could output their choices to a csv store - these can be made user specific with the create_context argument

outputlookup - Splunk Documentation

Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...